# Lesson 4: The notice before consent | Learn DPDP | FOCTTA > Before or with every consent request, the Fiduciary must give a clear notice. Rule 3 sets out what it must contain. Web page: https://foctta.com/learn/notice This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 4 Lesson 4 of 12 · 5 min read # The notice before consent Before or with every consent request, the Fiduciary must give a clear notice. Rule 3 sets out what it must contain. Jump to the quiz ## Where things stand - Not yet in force. Section 5 and Rule 3 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c); Rules r.1(4) - Section 17(3) lets the Government exempt notified Fiduciaries, including startups, from section 5. No such notification was located. Checked 28 Sep 2026 Source: Search of eGazette and meity.gov.in, 28 Sep 2026: not confirmed ## When a notice is needed Every request for consent must be accompanied or preceded by a notice from the Data Fiduciary. The Act's example is a bank's video-based customer identification: the bank must describe the personal data and the purpose before or with its request for the data. Sources: Act s.5(1) ## What the Act says it must contain The notice must tell the person the personal data and the purpose, how to withdraw consent and use the grievance process, and how to complain to the Board. The person must be able to read it in English or any language in the Eighth Schedule to the Constitution. Sources: Act s.5(1) Act s.5(3) ## What Rule 3 adds Rule 3 says the notice must stand on its own, understandable without other information. In clear and plain language, it must give an itemised description of the personal data and the specified purpose. It must also give a specific description of the goods, services or uses the processing enables. The notice must also give the link to the website or app, and describe any other means, for three things. They are withdrawing consent as easily as it was given, exercising rights under the Act, and complaining to the Board. Sources: Rules r.3 ## Consent requests and older consents The consent request itself must use clear and plain language, offer English or an Eighth Schedule language, and give contact details of the DPO or another person authorised to respond. For consent given before commencement, the Fiduciary must send a notice as soon as reasonably practicable, and may keep processing until the person withdraws. Sources: Act s.6(3) Act s.5(2) ## Key points - Give the notice before or with every consent request. - Itemise the data; state the purpose and the goods or services. - Link to withdrawal, rights and Board complaints. - Offer English or an Eighth Schedule language. - Existing consents need a notice as soon as reasonably practicable. ## In practice A checklist for your organisation. - Write one standalone notice per purpose, itemising each data field. - Translate notices into the languages your customers use. - Put withdrawal, rights and complaint links in every notice. - Plan notices for customers who consented before commencement. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### When must the notice reach the Data Principal? - Only if she asks for it - Before or together with the consent request - Within 30 days after consent - Once a year Show the answer **B. Before or together with the consent request** Section 5(1) requires every request for consent to be accompanied or preceded by a notice. Act s.5(1) 2. Question 2 of 5 ### How must the notice describe the personal data under Rule 3? - As one general category - It need not describe it - By a link to a policy only - As an itemised description Show the answer **D. As an itemised description** Rule 3(b)(i) requires, at the minimum, an itemised description of the personal data. Rules r.3(b) 3. Question 3 of 5 ### Which means must the notice describe under Rule 3(c)? - Means to withdraw consent, exercise rights and complain to the Board - Only a sales contact - The company's share price - None; a phone number is enough Show the answer **A. Means to withdraw consent, exercise rights and complain to the Board** Rule 3(c) requires a link and other means to withdraw consent, exercise rights under the Act and make a complaint to the Board. Rules r.3(c) 4. Question 4 of 5 ### In which languages must the person be able to access the notice? - Any language the company prefers - English only - Hindi only - English or any language in the Eighth Schedule to the Constitution Show the answer **D. English or any language in the Eighth Schedule to the Constitution** Section 5(3) requires the option to access the notice in English or any language specified in the Eighth Schedule to the Constitution. Act s.5(3) 5. Question 5 of 5 ### A customer consented before the Act commenced. What must the Fiduciary do? - Give her a notice as soon as reasonably practicable - Nothing at all - Delete her data at once - Ask the Board for permission Show the answer **A. Give her a notice as soon as reasonably practicable** Section 5(2)(a) requires a notice as soon as reasonably practicable; section 5(2)(b) allows processing to continue until she withdraws. Act s.5(2) Try again[Next lesson: Consent in detail, Consent Managers](https://foctta.com/learn/consent-and-consent-managers) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 3 **Consent and legitimate uses**](https://foctta.com/learn/lawful-grounds) [Lesson 5 → **Consent in detail, Consent Managers**](https://foctta.com/learn/consent-and-consent-managers) **In this lesson** 1. Where things stand 2. When a notice is needed 3. What the Act says it must contain 4. What Rule 3 adds 5. Consent requests and older consents 6. Key points 7. In practice 8. Quiz Take the quiz